Privacy notice

# 1. Who is responsible for your data

The data controller for personal data collected via this website is:

Global Premium Telecom B.V. ("GlobalXess")
Middelerf 14, 3851 SP Ermelo, The Netherlands
Dutch Chamber of Commerce (KvK): 71556966
VAT: NL858761567B01
Email: support@globalxess.com
Telephone: +31 20 893 8450

We do not currently have a statutory obligation to appoint a Data Protection Officer under Article 37 GDPR. Privacy questions and data subject requests are handled by the operations team, reachable on the email above.

# 2. What we collect and why

We only collect what we need to answer your question or run our service.

Forms on this website

• Contact form - name, email, company (optional), message.
• Business sign-up form - company details (registered name, KvK/CoC number, VAT, address), contact person details (name, role, email, phone), and an optional use-case description.
• ITW Washington 2026 follow-up form - name, company, email, an optional preferred meeting slot and an optional message.

Server-side request data

• The IP address of the device making the request.
• The HTTP request line (path, method, status code, response size, duration) and the User-Agent header.
• A first-party cookie called _xs that holds an opaque ULID. It is used to correlate page-views server-side and is classed as strictly necessary; details are in the cookies notice.

Server-side audience measurement

We use Google Analytics 4 in server-side Measurement Protocol mode only. There is no gtag.js, no Google Tag Manager, no Meta Pixel, no LinkedIn Insight Tag and no behavioural-tracking SDK loaded in your browser. Concretely:

• Aggregate page-views and a small number of conversion events (form submissions sent to us via the contact, sign-up and ITW pages) are forwarded from our server to Google Analytics over a server-to-server HTTPS request to https://www.google-analytics.com/mp/collect.
• The client_id we send to Google is a SHA-256-derived pseudonymous identifier seeded from the strictly necessary _xs cookie and a server-side salt. We do not send your name, email, IP address, advertising ID, or any other directly identifying field.
• We send non_personalized_ads = true on every event, so Google Analytics may not use the data to build advertising audiences.
• Google Analytics IP-anonymisation is applied automatically to Measurement Protocol traffic.
• Data is retained in Google Analytics for 14 months. Google signals (cross-device tracking) is disabled for this property.

We do not use third-party advertising tags, retargeting pixels, or behavioural-tracking SDKs anywhere on this website. The cookie banner you might expect under ePrivacy is not required because the only client-side cookie we set is strictly necessary - see the cookies notice.

# 3. Lawful basis

Per Article 6(1) GDPR our lawful bases are:

• Article 6(1)(b) - pre-contractual steps: processing of contact-form, ITW form and business sign-up form data, where you are asking us to take steps before potentially entering into a contract.
• Article 6(1)(f) - legitimate interests: short-term server-side request logs, abuse detection (e.g. honeypot fields), and the strictly-necessary _xs cookie. Our legitimate interest is keeping the website available, secure and operationally observable. We have weighed this against your right to privacy and only retain the minimum necessary for the minimum necessary time.
• Article 6(1)(c) - legal obligation: retention of records that we are required by Dutch tax or telecom law to keep (for example invoicing data, where applicable).

We do not rely on consent (Article 6(1)(a)) for anything on this website. The server-side Measurement Protocol pipeline described above runs under Article 6(1)(f) (legitimate interest in understanding which content actually serves visitors, balanced against minimal, pseudonymised payloads with no advertising IDs and no client-side script). Because no third-party tag is loaded in your browser and the only cookie we set is strictly necessary, no consent banner is required under ePrivacy / Tw 11.7a.

# 4. Recipients and processors

Inside GlobalXess, form submissions are accessible to the sales, operations and engineering staff who need to follow up on them.

The following processors process personal data on our behalf:

• Slack Technologies LLC (a Salesforce company), USA - we use a Slack incoming webhook to deliver new form submissions to a private internal channel so the team sees them in real time. Slack acts as a processor under the GDPR; the underlying customer-data processing is governed by the Salesforce Data Processing Addendum and the EU Standard Contractual Clauses (see § 5 below).
• Google LLC, USA - we forward aggregate, pseudonymised page-view and conversion events to Google Analytics 4 via the server-side Measurement Protocol described in § 2. Google acts as a processor for the Measurement Protocol payload; the underlying processing is governed by the Google Ads Data Processing Terms and the EU Standard Contractual Clauses (see § 5 below).
• Cloud-infrastructure providers hosting this website and its supporting services in the European Union under standard infrastructure-as-a-service contracts.

We do not sell your personal data, and we do not share it with advertising networks.

# 5. International transfers

The website itself is operated from infrastructure inside the European Union. Form-submission notifications are delivered to Slack, which is a US-based service. Where personal data leaves the EEA in this way, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) as supplemented by Slack/Salesforce's technical and organisational safeguards. A copy of the SCCs is available from the operator on request.

# 6. How long we keep it

We retain personal data only for as long as we need it for the purpose for which it was collected:

• Contact-form submissions: up to 24 months after the last contact, to support follow-up conversations and audit. Deleted earlier on request.
• Business sign-up form: as long as the business relationship is active, then up to 7 years to comply with Dutch commercial bookkeeping retention obligations (Article 2:10 BW / Article 52 AWR) where the data is part of the underlying records.
• ITW follow-up leads: up to 12 months after the event.
• Server-side request logs: up to 90 days for operational and security purposes.
• The _xs cookie: up to 13 months on your device.

# 7. Your rights

Under the GDPR you have the right to:

• request a copy of the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased where the legal basis no longer applies (Article 17);
• restrict processing in defined circumstances (Article 18);
• receive your data in a portable, machine-readable form (Article 20);
• object to processing based on our legitimate interests (Article 21);
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

# 8. How to exercise your rights

Send a Data Subject Access Request (DSAR) to support@globalxess.com with the subject line "Data subject request". We aim to respond within 30 calendar days, as required by Article 12(3) GDPR. If your request is complex we may extend this by a further two months and we will tell you why.

To protect your data we may ask you to confirm your identity before fulfilling a request. Where the request is for the deletion of an active business contact whose data we are required to retain by law, we will explain which records we must keep and why.

# 9. Changes to this notice

We may update this notice when our processing changes, when a new processor is introduced, or when the law changes. The "Last updated" date in the sidebar always reflects the date of the current version. Material changes are announced in the news/blog section before they take effect.